Using Mobility Tokens to Observe Malicious Mobile Code 
Abstract of the Disclosure 

One or more mobility token managers (101) track movement of 
files (105) within a network. A mobility token manager (101) on 
5 a source computer (113) detects an attempt to write a file (105) 
to a target computer (117) . Responsive to the detection, the 
mobility token manager (101) writes a mobility token (103) 
containing data concerning at least the file (105) and the' write 
operation to the target computer (117) . A mobility token 

10 manager (101) on the target computer (117) detects that the 
mobility token (103) is being written to the target computer 
(117) . The mobility token manager (101) on the target computer 
(117) reads the mobility token (103), and determines relevant 
information concerning the file (105) associated with the 

15 mobility token (103) . 
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